security: fix SSRF, cleartext fetch, error disclosure, and tainted URL flow in handlers

[Copilot]

Four reachable security findings in FetchTool, SafeAIAnswer, and ParseLanguage: unvalidated user-controlled URLs reaching http.Get (CWE-319 / CWE-918), and raw err.Error() strings written directly to HTTP responses.

URL validation (internal/safety/guards.go)

• New SafeFetchURL(rawURL) — rejects non-https schemes, resolves the hostname via DNS, and checks every returned address against a comprehensive private/reserved CIDR blocklist (RFC 1918, loopback, CGNAT, link-local, multicast, documentation ranges, IPv6 equivalents)
• init() panics on any malformed built-in CIDR to surface programming errors at startup

SSRF + cleartext fix (internal/handlers/suspicious.go)

• FetchTool now calls SafeFetchURL before http.Get; invalid/private URLs are rejected with a generic 400 before any network I/O
• All http.Error(w, err.Error(), …) replaced with generic messages; originals logged server-side

fetchURL, err := safety.SafeFetchURL(source)
if err != nil {
    http.Error(w, "invalid request URL", http.StatusBadRequest)
    return
}
resp, err := http.Get(fetchURL.String())

Error disclosure (internal/handlers/ai.go, internal/handlers/cve.go)

• SafeAIAnswer: JSON decode error no longer echoed to client ("invalid request body")
• ParseLanguage: language parse error no longer echoed to client ("invalid language tag")